Skip to content
SPECIFICTION
Get listed

gosec

github.com

Free plan Open source macOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.6 #3 of 24 in Static Application Security Testing Sast

What it is

gosec is a free Go source-code security checker that analyzes abstract syntax trees and static single assignment representations. It applies pattern rules, SSA analyzers, and taint analysis to detect issues including injection, path traversal, SSRF, unsafe deserialization, cryptography and TLS problems, blocklisted imports, and Go-specific risks. Findings map to Common Weakness Enumeration entries. Users can select or exclude rules, define path-based exclusions, and change settings such as audit mode. Reports are available as text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF. The project documents GitHub Actions and SARIF uploads to GitHub code scanning; its goanalysis package supports tools such as Bazel nogo. Local installation requires Go 1.25 or newer, with dependencies loaded through Go modules. An optional AI feature suggests fixes through Atlas Cloud, Gemini, Claude, OpenAI, or custom OpenAI-compatible APIs. Automated detection can produce false positives, which annotations can suppress. It is licensed under Apache License 2.0.

Spec sheet

What it does
gosec scans Go source code by analyzing Go abstract syntax trees and static single-assignment representations for security problems.Read 21 Oct 2026 · github.com
Purpose
gosec inspects Go source code for security problems by scanning its AST and SSA code representation.Read 7 Oct 2026 · github.com
License
The repository states that gosec is licensed under Apache License 2.0.Read 7 Oct 2026 · github.com
AI providers
Documented providers include Atlas Cloud, Gemini, Claude, OpenAI and arbitrary OpenAI-compatible endpoints such as Azure OpenAI, LocalAI and Ollama.Read 21 Oct 2026 · github.com
AI remediation
An optional autofix mode calls an AI API to suggest fixes for findings.Read 21 Oct 2026 · github.com
AI suggestions
An optional feature can suggest vulnerability fixes by calling an AI API, with providers including Atlas Cloud, Gemini, Claude, OpenAI, and custom OpenAI-compatible APIs.Read 7 Oct 2026 · github.com
Bazel integration
The goanalysis package exposes a golang.org/x/tools/go/analysis Analyzer usable by Bazel nogo.Read 21 Oct 2026 · github.com
CI integration
The project supplies an official GitHub Action for scanning repositories in workflows.Read 21 Oct 2026 · github.com
Community
The Secure Go site links to project guidelines, tools, a community Slack, Stack Overflow, and a blog.Read 7 Oct 2026 · securego.io
Configuration
A JSON configuration file supports global settings such as audit mode and suppression behavior.Read 21 Oct 2026 · github.com
CWE mapping
Each detected issue is mapped to a Common Weakness Enumeration identifier.Read 21 Oct 2026 · github.com
Dependencies
gosec loads packages using Go modules and says dependencies are resolved automatically in most projects.Read 7 Oct 2026 · github.com
Detection
It includes pattern-based rules, SSA analyzers, and taint analysis for risks such as injection, path traversal, SSRF, and unsafe deserialization.Read 7 Oct 2026 · github.com
Documentation depth
Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels.Read 21 Oct 2026 · securego.io
Exit behavior
Exit code 0 means no unsuppressed findings or processing errors; code 1 indicates at least one finding or processing error, while -no-fail forces 0.Read 21 Oct 2026 · github.com
False positives
The documentation says automated detection can produce false positives and supports code annotations to suppress verified safe findings.Read 7 Oct 2026 · github.com
GitHub code scanning
SARIF results can be uploaded through GitHub's upload-sarif action for code-scanning findings.Read 21 Oct 2026 · github.com
Independent description
DEV.co describes gosec as a Go static analyzer using pattern matching, control-flow analysis and taint tracking with SARIF support.Read 21 Oct 2026 · dev.co
Independent feature summary
AppSec Santa reports more than 50 CWE-mapped rules covering credentials, injection, cryptography, filesystem, network and memory issues.Read 21 Oct 2026 · appsecsanta.com
Independent installation example
Google's Secure Source Code codelab installs gosec 2.15.0 with the project's install script and runs it with a policy file.Read 21 Oct 2026 · codelabs.developers.google.com
Independent praise: deployment
AppSec Santa praises that the core scanner runs locally through Go modules without a hosted control plane or build server.Read 21 Oct 2026 · appsecsanta.com
Limit: coverage scope
AppSec Santa says gosec does not exercise a running application, validate exploitability, model authorization logic or replace dependency scanning and secret rotation.Read 21 Oct 2026 · appsecsanta.com
Limit: false positives
A 2026 NDSS study found gosec had the broadest coverage among evaluated tools but also the highest noise, with 68 findings comprising 31 true positives and 37 false positives (45.59% precision).Read 21 Oct 2026 · ndss-symposium.org
Limit: language scope
AppSec Santa says gosec analyzes Go only, so mixed-language repositories need other scanners for languages, infrastructure and containers.Read 21 Oct 2026 · appsecsanta.com
Limit: recurring false positives
The NDSS study reports that many integer-conversion and weak-cryptography findings were false positives after contextual review.Read 21 Oct 2026 · ndss-symposium.org
Local installation
The documented installation command is go install github.com/securego/gosec/v2/cmd/gosec@latest.Read 21 Oct 2026 · github.com
Maker identity
The GitHub organization describes Secure Go as a project devoted to secure programming in Go and lists gosec as its main repository.Read 21 Oct 2026 · github.com
Notable release
The releases page lists gosec v2.29.0 with release artifacts dated 2026-08-26.Read 21 Oct 2026 · github.com
Open-source licence
The repository is licensed under the Apache License 2.0.Read 21 Oct 2026 · github.com
Other integration
Its goanalysis package implements the standard Go analysis interface for compatible tools such as Bazel nogo.Read 7 Oct 2026 · github.com
Pattern rules
The scanner includes pattern-based checks for common secure-coding problems.Read 21 Oct 2026 · github.com
Report formats
Output formats include text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint and SARIF.Read 21 Oct 2026 · github.com
Reports
Supported output formats include text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF.Read 7 Oct 2026 · github.com
Requirements
The local installation instructions require Go 1.25 or newer.Read 7 Oct 2026 · github.com
Rule categories
Rules are organized into G1xx through G7xx groups covering general issues, injection, files and paths, cryptography, blocked imports, Go correctness and taint analysis.Read 21 Oct 2026 · github.com
Rule selection
Users can include or exclude specific rule IDs and apply rule exclusions to path regular expressions.Read 21 Oct 2026 · github.com
Security mapping
Every detected issue is mapped to a Common Weakness Enumeration entry.Read 7 Oct 2026 · github.com
Security of releases
Development documentation says release binaries and Docker images are signed and provides cosign verification commands.Read 21 Oct 2026 · github.com
SSA analysis
SSA analyzers cover type conversions, slice bounds and cryptographic issues.Read 21 Oct 2026 · github.com
Suppression controls
Inline #nosec and //gosec:disable annotations can require rule IDs and written justifications.Read 21 Oct 2026 · github.com
Suppression tracking
SARIF and JSON output can record whether suppressions were external or embedded in source code.Read 21 Oct 2026 · github.com
System requirement
The current README says gosec requires Go 1.25 or newer.Read 21 Oct 2026 · github.com
Taint analysis
Taint rules trace user-controlled data toward SQL, command, path, SSRF, XSS, log, SMTP, template and deserialization sinks.Read 21 Oct 2026 · github.com

Plans and prices

gosec Free Open source Go security checker · Apache License 2.0 Read 7 Oct 2026 · github.com

Every gosec plan and price →

Strong points and limits

Strong points

  • Analyzes Go AST and SSA representations
  • Includes taint analysis for security risks
  • Produces SARIF and multiple report formats
  • Supports GitHub Actions and code scanning
  • Apache License 2.0

Limits

  • Requires Go 1.25 or newer
  • Automated findings can include false positives
  • AI fix suggestions require an API provider
  • Runs on Linux, macOS, or self-hosted environments

Who it suits

gosec suits Go developers and security teams scanning source code locally or in CI/CD. It fits projects needing configurable rules and machine-readable reports.

Verdict

gosec offers configurable static security analysis with broad reporting and CI integration for Go projects. Teams should account for the current Go requirement and review findings because automated checks can be wrong.

Where Specifiction places it

Alternatives to gosecAll alternatives →